Bug 463188 (CVE-2008-3836)

Summary:	CVE-2008-3836 mozilla: Privilege escalation using feed preview page and XSS flaw
Product:	[Other] Security Response	Reporter:	Josh Bressers <bressers>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	urgent	Docs Contact:
Priority:	urgent
Version:	unspecified	CC:	security-response-team, vdanen
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
URL:	http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-3836
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2010-04-08 18:00:02 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Comment 2 Josh Bressers 2008-09-23 17:48:39 UTC

From MFSA 2008-39:
Mozilla security researcher moz_bug_r_a4 reported a series of
vulnerabilities in feedWriter which allow scripts from page content to run
with chrome privileges.

This flaw does not affect us.  It only affects Firefox 2, but not SeaMonkey (as
the feature does not exist in the version of SeaMonkey we ship).

Comment 3 Josh Bressers 2008-09-24 00:54:59 UTC

This is now public